NIST guides civilian infosec buys

NIST Special Publication 800-23 (PDF)

The National Institute of Standards and Technology late last week released

its final guidelines on civilian agency procurement of information security


Under the new guidelines, NIST Special Publication 800-23, NIST recommends

that agencies acquire security products that have undergone independent

testing and evaluation.

"Federal agencies should give substantial consideration in IT procurement

and deployment for IT products that have been evaluated and tested by independent

accredited laboratories against appropriate security specifications and

requirements," the guide states.

The main type of testing recommended by the publication is the international

Common Criteria Evaluation and Validation Program, overseen in the United

States by the National Information Assurance Partnership under NIST and

the National Security Agency.

Using the Common Criteria Cvaluation, agencies can be assured that the security

products will perform the way a vendor promises. The products are tested

by private-sector laboratories accredited by the NIAP.

NIST cautions, however, that agencies still need to make sure a security

product fits into their overall architecture and needs because a Common

Criteria-tested product may not be the best security product for an agency

to buy.

"It is important to note that purchasing an evaluated product just because

it is evaluated, and without due consideration of applicable functional

and assurance requirements, may be neither useful nor cost-effective," the

guide states.


  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.